BRPI0309249B1 - ADVANCE PAYMENT SYSTEM FOR SUBSCRIPTION TV - Google Patents

Abstract

The prepayment system has control words transmitted from a management center with a control message. There is a security unit decrementing the credit amount over a time set by the management message. A single number identification and code value corresponding to the amount is passed to the center control. The processor process and verifies the code value communication an identification representing a single number and recharge amount.

Description

(54) Title: EARLY PAYMENT SYSTEM FOR SIGNATURE TV (51) Int.CI .: H04N 5/00; H04N 7/16; G07F 7/08 (30) Unionist Priority: 11/04/2002 EP 02008061.0 (73) Holder (s): NAGRAVISION SA (72) Inventor (s): MARCO SASSELLI • ·· ····

ADVANCE PAYMENT SYSTEM FOR SUBSCRIPTION TV

The present invention relates to the domain of service receivers / decoders

conditional access points, in particular, a system of access to a stream of encrypted data calculated by a time unit.

As an example of such data stream, it can be an information service about stock exchange, weather forecast, television of general interest, a sporting event, among others. These contents can be transmitted on user terminals such as a pay-TV decoder, a computer, a portable phone, a “palm-top”, a “PDA”, a radio, a television, or a φ 10 multimedia terminal.

The digital stream is encrypted in order to be able to control usage and define the conditions for it. This encryption is conducted thanks to the keywords, which are changed at regular intervals (between 5 and 30 seconds) to avoid any attack aimed at finding such a keyword.

In order to allow the user terminal to decode the encrypted chain by a password, the last one is sent to the terminal independently of the chain, in a control message (ECM) encrypted by a key convenient to the transmission system between the center of communication. (CAS) and the security module of the user terminal.

In fact, security operations are performed in a security module (SC) that is presented in the form of an inviolable smart card. This device can also be a removable type or be directly integrated with the user group, processing the signals, as well as a pay-TV decoder or a DAB receiver. In fact, the functionality of the invention allows the use of a user terminal without a removable security module.

-2 ·· ·· ♦ ·

When decrypting control words (ECM), the security module (SC) verifies the right of access to what is considered current.

This right can be administered through authorization messages (EMM), which carry such right to the unit (SC). Other possibilities are also possible, such as sending decrypted keys.

The measurement of the use of such content today is based on the principle of subscription, the purchase of individual events or payment per unit of time.

The subscription allows defining a right associated with one or more broadcast channels and allows the user to obtain these channels ordered if the right is present in its security module.

At the same time, it is possible to define specific rights to some content, such as a movie or a football game. The user can acquire this right (buy, for example) and these contents will be controlled specifically by this right. This method is known as “pay-per-view” (PPV).

As for the payment per unit of time, the security module has a credit that is debited according to the user's real consumption. So, for example, one unit will be debited from this credit every minute, regardless of the channel watched. It is possible, depending on technical implementations, to vary the unit of measurement, in duration, or by the amount of time allowed, by combining these two parameters to adapt the billing to the type of product transmitted.

When decrypting the control words, it will be checked whether a right associated with the access conditions is present in the security module.

The control word is returned in decrypted form to the user terminal only when the comparison is positive.

This mode of operation requires the administrative center to know the user, his physical address, his bank details, as well as the payment method that authorizes him to renew his rights.

In fact, the subscription principle is based on the mandatory renewal, which means that a right is canceled if it is not renewed. This procedure prevents those who have subscribed to all available channels from ending their subscription and ensuring that the end message never reaches your user terminal. That is why the entitlement includes a limited access time to all channels, which, if not renewed, is automatically canceled after a month, for example.

Thus, one can imagine the work required to monitor the thousands of subscribers who regularly pay their bills and to whom it is necessary to send a monthly renewal message. In addition, this message must be repeated for several days because the control system does not know whether the user terminal is on.

Often it happens to a user who went on vacation and turned off their equipment, on their return find their user blocked. Then he needs to call the administrative center so that a personalized renewal message can be sent to him.

Thus, a large part of the resources and costs associated with the administration of a central office is intended for the administration of subscribers.

A first solution, using an electronic wallet, is described in US 6282293. The smart card contains a credit that is charged when encrypted content is accessed. The billing information is included in the transmitted signal and is allowed. To recharge the credit, the user terminal calls the

-4 administrative center to send the consumed events and to recharge the credit according to the terms agreed with this user, for example, through a credit card.

In a large number of cases, on the one hand, the user terminal does not have a communication channel with the administrative center and, on the other hand, we want to avoid recording all users in a database with their payment methods. Thus, this document does not allow to solve the objectives of the invention, that is, the creation of a set of user terminals without a return channel and without the knowledge of each user.

The purpose of this invention is to propose an innovative way to offer access to pay television to a large clientele and thus dramatically reduce costs related to the administration of subscribers.

This objective is achieved by a system having an administrative central that transmits a data stream encrypted by control words (CW). These keywords are included in control messages (ECM). This data stream is intended to be received by at least one user terminal connected by a security module identified by a single address. This security module contains a credit, which is reduced according to the purchase of products or the consumption of data stream. Characterized in this, the security module includes means to reduce the credit to an amount related to a product or to an amount referring to a duration, this amount and / or this duration is defined in the control message (ECM) or in an authorization message (EMM). The user has an independent user terminal that transmits an identifier representing the address, and a value code representing the amount of credit recharged to the administrative center, which has the means to ·· ·

·· • · • · ··· ·· verify and handle the value code and transmit an encrypted message with the address and the amount of credit to reload the security module.

In this way, according to the invention, the means of recharging credit are independent of the user terminal while maintaining the administrative center as supervisor of recharging operations. Furthermore, the transmission of this value code makes it possible to suppress the user's collection, because this value code already contains the information proving that the user has the right to this value. In accordance with other previous solutions, the administrative center handles the customer's credit (invoice, credit card) independently and transmits the recharge instructions via the modem.

According to this invention, the value code is transmitted using one of the modes described below and the reload instruction is sent to the encrypted data stream, in a control message, for example.

This vaior code (VC) can take several forms:

1) A unique number is contained on a scratch card and defines a prepaid credit. These cards are sold in stores and have a part covered by an easily removable layer through the fingernail or a coin. The number revealed is a simple number, produced by a cryptographic system, which must respect strict rules in its format. It is not possible, in this way (or with little probability) to produce a number that is recognized as valid by the administrative central.

2) A bank account or credit card number and the amount to be topped up. According to the terms accepted by the administrative center in the contract with the banking institutions, the user can inform his bank card number and the desired amount to be debited from his account. In this option, it is

-6 it is possible to use a removable security module and insert it in a terminal for this purpose. This terminal allows you to receive cash in cash (cash notes, for example) or to read a bank card (even a credit card). Once the amount desired by the user is duly verified (either by the notes introduced at the opening of the terminal or by the authorization of the bank organization), the terminal contacts the administrative center and a credit recharge message is sent to the terminal that transfers it to the security module. During this operation, it is possible to search for data on the user's consumption, information that is kept in its security module.

3) A phone number or cordless phone number and the amount to be recharged. The user can simply inform the administrative center of the desired amount to be recharged. In this message, the sender's number is automatically included and according to the agreements between the telephone operator and the administrative center, the desired amount is debited from the telephone bill.

According to the chosen operating procedure, the user communicates the value code to the administrative center accompanied by the identifier of its user terminal. In this type of application, the unique address of the security module will be considered as the group number formed by the user terminal and the security module. For simplification reasons, it is possible to generate a simplified code representing the unique address. In fact, this address is usually a number comprising a large number of digits, which are necessary for the system (date of creation, version, etc.), but not essential to identify the unit. That is why a simplified number of the user terminal (STB) is sufficient to differentiate each unit.

-7: Υ :: '’? :::: ·' '::. /// • · · ·· · ··· · ···· ··· * * ······· ·· · ·

According to a particular incorporation, it is possible for the user to transmit another number to the administrative center, instead of the simplified number, during the initialization period.

For example, it could be the user's phone number. The administrative center verifies that this new number is exclusive and associates this number with the exclusive address (UA). Consequently, it will be possible to replace the identification of the user terminal with the telephone number.

To recharge their credit, the user can use a voice server and a classic phone that sends signals via DTMF. After having purchased a value card (solution 1 for the value code), he calls the central office's voice server. He is asked to enter his unique address (UA) and the value code fixed on the card.

This operation does not take long, the administrative center verifies the agreement of the value code and the identifier and if this information is correct, it prepares a destination message for this user terminal.

The message is transmitted over the broadcast channel in encrypted form and only the security module has the means to decrypt this message. Each security module that receives this message checks whether the unique address contained in the message matches its address and, if negative, ignores it.

The amount of credit contained in this message is added to the remaining credit of the unit that corresponds to the unique address (UA).

The term “administrative center” is to be understood widely. In fact, in practice, this entity is subdivided into several modules that can be located in different places. These modules are the control message encryption unit (ECM), authorization message encryption unit (EMM)

-8 • · · ·· · ··· · ···· ··· ······· ·· · · responsible for recharging the credit. The unit dealing with value codes can be located in a banking establishment, considering variant 2, that is, the connection with the credit center; or on the premises of a telephone operator, considering variant 3, that is, the sending of messages by portable phone.

Once the value code is recognized and handled, a secure connection allows the cryptographic unit to be informed that an administrative message, the unit responsible for sending the reload message, must be sent to the receiver.

The user always has the means to display the remaining credit on his television.

According to the mode using the portable phone, a simple message (SMS) containing the value code and the identification of your unit allows you to recharge your credit. If, in addition, the identifier has been replaced with your phone number, only the value code will be sent, as the phone number is automatically sent to the recipient.

When credit in the security module (SC) is sufficient, several modes of operation are possible, namely:

- impulsive subscription: the user decides to use all or part of his credit to subscribe to one or more channels. Then, a new right is created in the unit to receive such channels, without the need for any new action on your credit.

- impulsive purchase: the user can decide to buy a transmission or a transmission group (a series or a retrospective) and a corresponding right is created in the security module.

-9ΊΥ *: ”?: ** :: **: · ** ::.

• · · ·· · ··· · ···· ··· ······· ·· · ·

- reduction according to the time used: the user can decide to pay only what he actually used and the credit is used according to the method of payment per unit of time.

The first two modes are preferably administered by authorization messages (EMM), because they create a right within the security module, while the third mode can work only with control messages (ECM), where the unit value is placed like this as the acquired duration. When a control message (ECM) is presented to the security module, entitlements are checked according to a hierarchy, starting from the broadest entitlement to the most limited entitlement. So, for example, first check if the user has a subscription for these rights, then if an impulsive purchase right exists and, as a last resort, debit credit per unit of time.

In Figure 1, an embodiment is revealed. It is about variant 3 of the value code. The administrative central (CG) is revealed by several elements such as a telephone operator (TO), a data encryption module (DTA), control key encryption module (ECME), responsible for generating control messages (ECM) and an administrative module (EMME), responsible for generating the credit reload messages for the security modules. Each decoder (STB) comprises a security module (SC) that stores the user's credit (CR).

According to the example of the value code in the form of a scratch card containing a single number, the user uses his portable phone (TP) to transmit this number, connecting to the telephone operator (TO). This operator receives the information and transmits it to the administrative module (EMME) with the user's phone number. The validity of this number is verified thanks to the database • · · ·· · ··· · ···· ··· I ········· · · '(DB) of the validity numbers and, if it is the first time this number is used, the corresponding value (TA) is returned to the database. This number is then irrevocably invalidated.

Thanks to the telephone number provided by the telephone operator, the administrative module (EMME) deducts the unique address (UA) of the security module and a corresponding message can be sent via the classic transmission channel (cable, radio, etc.). This message is usually repeated for a few days.

For this purpose, it is useful to add that the security module comprises means to process the message only once. This is ensured by a message identifier which is also encrypted by transmission keys.

This identifier is stored in the security module, so only this message is received and processed. The security module then waits for a different or higher identifier.

According to this procedure, the database keeps a signal of the amount recharged for each security module. It is possible to check the consumption of each unit and to detect fraud attempts. In addition, the sum of the recharged amount must always be less than the sum of the value cards in circulation.

Claims (3)

1. System comprising an administrative central (CG) that transmits a data stream encrypted by keywords (CW), these keywords being included in control messages (ECM), said data stream is received by at least one user terminal (STB) connected by a security module (SC) identified by a single address (UA); said security module (SC) contains numerical information to be used (CR), CHARACTERIZED by the fact that the security module (SC) includes means to update the numerical information to be used to a first amount (M1) referring to a product or to a second amount (M2) referring to a duration (T), being that these amounts (M1, M2) and / or this duration (T) are / are defined in a control message (ECM) or in an authorization message (EMM); the independent user terminal (STB) transmits an identifier representing the address (UA), and a value code (VC) representing a numerical information (TA) to be used (CR) for the administrative center (CG), which checks and handles of the value code (VC) and transmits it to the encrypted data stream (CW), by means of encrypted messages having the address (UA) and the corresponding numerical information (TA) to be used (CR), to update the numerical information to be used in the security module (SC). of 08/28/2017, p. 8/9 2. System, according to claim 1, CHARACTERIZED by the fact that the value code (VC) is an exclusive code and pre-established by the administrative central, complying with cryptographic rules of composition, in which 5 the administrative center comprises means of checking this code and identifying the numerical information to be used that will be inserted in the security module (SC). 3. System, according to claim 1, CHARACTERIZED by the fact that the user has a number 10 telephone (TN) comprising means of associating the exclusive address (UA) with its telephone number (TN) and by which the value code (VC) is transmitted to the administrative central accompanied by the telephone number (TN), being that central has the means to transmit the update message to the 15 user terminal (SC), whose unique address (UA) is associated with this telephone number. Petition 870170063051, of 08/28/2017, p. 9/9 1/1 β · · · ·· · ··· · ···· ··· ········· · · ·